How to list all files and emails on a HDD or image

To list all files, individual emails and files stored within .ZIP archives you can use the signature creation function in OSForensics. Choose the folder that you wish the list the files for, this can be a local folder, and image file that has been mounted to a drive letter or an image file that has been associated with a case.

Click the configuration button and select "File Listing" for the output type. If MD5 or SHA1 hashes are required select them in the Hashes drop down list (this will slow down the process as hashes will be created for each file found). If a listing of files within .ZIP files or emails within .PST files are required select the appropriate checkboxes.

Click the Start button and wait for the process to complete, one it has you can choose where the save the .CSV file that will contain the file listing.

Below is an example of the file listing output showing individual emails that were stored in a .PST file.

Note: OSForensics version 1.1 or higher required